benchmark-runner (>=1.0.141, <=1.0.362), proxmox-pci-switcher (>=0.10.6, <=0.10.7) +4 more potentially affected by CVE-2026-44405 via paramiko (2.8.0)

paramiko PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - benchmark-runner =1.0.141, =0.10.6, =0.9.17, =0.0.2, =0.2.7, =0.2.9 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-2858...

PT-2026-59302

Summary Mistune is vulnerable to a CPU exhaustion DoS due to superlinear approximately On² behavior in parse link text. A relatively small input consisting of repeated characters causes significant parsing slowdown. Affected component mistune/inline parser.py → parse link text Description When...

Baselines Before Architecture: Evaluating Coding Agents for Autonomous Penetration Testing

Recent autonomous penetration testing papers report high benchmark scores while adding multi-component security harnesses around frontier LLMs. Because these systems often change both architecture and backbone model, it is difficult to tell how much performance comes from the harness rather than...

atxm (0.2.1), daktari (>=0.0.180, <=0.0.182) +20 more potentially affected by CVE-2026-59890 via setuptools (69.1.0)

setuptools PYPI version 69.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - atxm 0.2.1 - daktari =0.0.180, =0.2.11, =0.1.0, =0.1.3, =4.1.0, =0.1.0, =0.3.2, =0.7.3, =2024.2.5, =3.2.0, =3.5.0 and more Source cves:...

dataset-format-benchmark (0.0.10) potentially affected by CVE-2024-8020 via pytorch-lightning (1.9.2)

pytorch-lightning PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark 0.0.10 Source cves: CVE-2024-8020 Source advisory: OSV:PYSEC-2026-1857...

agixt (>=1.2.4, <=1.3.11), authx (0.9.1) +15 more potentially affected by CVE-2024-0727 via cryptography (41.0.0)

cryptography PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - agixt =1.2.4, =1.0.479, =1.3.5rc1, =1.0.0, =1.10.0, =2.0.0, =3.10.0rc1, =3.10.0rc1, =3.10.0rc1, =4.0.0a5 and more Source cves:...

aider-chat (>=0.82.3, <=0.85.2), aider-code (>=0.1.0.dev19, <=0.1.1.post14) +186 more potentially affected by CVE-2026-54060 via pillow (11.2.1)

pillow PYPI version 11.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aider-chat =0.82.3, =0.1.0.dev19, =0.0.1, =3.1.20260611, =0.1.0, =0.2.0, =0.1.0, =2026.5.28, =2026.4.15, =2.0.6, =25.5.0, =0.0.0, =1.4.3, =0.5.0b2,...

aider-chat (>=0.82.3, <=0.85.2), aider-code (>=0.1.0.dev19, <=0.1.1.post14) +186 more potentially affected by CVE-2026-55798 via pillow (11.2.1)

pillow PYPI version 11.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aider-chat =0.82.3, =0.1.0.dev19, =0.0.1, =3.1.20260611, =0.1.0, =0.2.0, =0.1.0, =2026.5.28, =2026.4.15, =2.0.6, =25.5.0, =0.0.0, =1.4.3, =0.5.0b2,...

When Claws Remember but Do Not Tell: Stealthy Memory Injection in Persistent Personal Agents

Persistent personal agents combine long-term memory with access to users' external environments, enabling personalized foreground assistance and proactive background execution. This integration also creates a new path to compromise: untrusted external content can be silently written into persiste...

ShadowProbe: Language-Extensible Detection of Hidden Algorithmic Complexity Vulnerabilities

Algorithmic Complexity Vulnerabilities ACVs arise when adversarial inputs trigger worst-case execution behavior, causing severe performance degradation or Denial-of-Service conditions. A key but underexplored source is shadow complexity: non-trivial computational costs hidden inside seemingly...

Generative AI and Federated Learning for Intrusion Detection Systems: A Survey

Intrusion Detection Systems IDSs are essential for monitoring network traffic and identifying malicious activities in modern cyber-physical, Internet of Things IoT, enterprise, and distributed network environments. However, developing reliable IDS models remains challenging because attack behavio...

LIB-TRAP: Standard Cell Library Hardware Trojan Risk Assessment and Prevention

Vulnerabilities inherent to the fabless semiconductor manufacturing model have significantly increased the risk of malicious Hardware Trojan HT insertion, posing severe threats to hardware security. Several HT mitigation and detection strategies have been developed, and existing works explore the...

Security update for 7zip

This update for 7zip fixes the following issues Update to 26.01: CVE-2026-48092: Information disclosure in 32-bit builds due to heap memory disclosure bsc1267858. CVE-2026-48095: Heap buffer overflow via NTFS compressed stream buffer under-allocation bsc1267421. CVE-2026-48101: Information...

dataset-format-benchmark (0.0.10) potentially affected by CVE-2024-8019 via pytorch-lightning (1.9.2)

pytorch-lightning PYPI version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark 0.0.10 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

dataset-format-benchmark (>=0.0.11, <=0.0.12), hybrid-graph (>=0.2.0, <=0.61.0) +2 more potentially affected by CVE-2024-8019 via pytorch-lightning (1.9.3)

pytorch-lightning PYPI version 1.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - dataset-format-benchmark =0.0.11, =0.2.0, =0.1.0, =0.1.1 Source cves: CVE-2024-8019 Source advisory: OSV:PYSEC-2026-507...

Security--Fidelity Tradeoffs: The Hidden Cost of Prompt Injection Defense

We identify a security-fidelity tradeoff in defending LLMs against indirect prompt injection: defenses resist injected instructions largely by suppressing untrusted text, which corrupts tasks that must preserve it, such as translation and document editing. Attack-success metrics cannot see this,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: trivy-operator, falcoctl, buildah, kaf, gptscript, step-kms-plugin, age, crossplane-provider-azure-authorization, chisel, teleport, kargo, pulumi-kubernetes-operator, kine, terraform-provider-tls, external-dns, aactl, atlantis, tflint, rancher-agent,...

CrypFormBench: Benchmarking Formal Analysis Capability of Large Language Models for Cryptographic Schemes

Manual formal analysis of cryptographic schemes is labor-intensive and requires substantial expertise. While model-checking tools e.g., Scyther and Tamarin and computational-security tools e.g., CryptoVerif and EasyCrypt improve the automation of security proofs, they still rely on experts to...

HelpBench: Assessing the Ability of LLMs to Provide Privacy, Safety, and Security Advice

This paper introduces HelpBench, a benchmark for assessing whether LLMs are capable of providing accurate help in response to questions about digital privacy, safety, and security. We curated 450 questions representing authentic user situations and developed rubrics for each question to evaluate...

Representation Matters: An Empirical Study of Program Representations for LLM Vulnerability Reasoning

Large Language Models LLMs are increasingly used for automated vulnerability detection, but it remains unclear how program structure and semantics should be represented for LLM-based reasoning. Most prompting-based approaches provide raw source code, implicitly assuming that more source-level...